Exam SC-200 topic 3 question 45 discussion

Actual exam question from Microsoft's SC-200

Question #: 45
Topic #: 3

You have a Microsoft Sentinel workspace.
You need to identify which rules are used to detect advanced multistage attacks that comprise two or more alerts or activities. The solution must minimize administrative effort.
Which rule type should you query?

A. Fusion
B. Microsoft Security
C. ML Behavior Analytics
D. Scheduled

Show Suggested Answer

Suggested Answer: A 🗳️

by Fukacz at Sept. 14, 2022, 10:49 a.m.

Comments

Submit Cancel

Fukacz

Highly Voted 1 year, 8 months ago

Selected Answer: A

https://docs.microsoft.com/en-gb/azure/sentinel/configure-fusion-rules

upvoted 7 times

...

Apocalypse03

Highly Voted 1 year, 5 months ago

Selected Answer: A

Fusion rules in Microsoft Sentinel are rules that are used to detect advanced multistage attacks by combining alerts and activities from different sources. Fusion rules can be used to identify attacks that may not be detectable by a single alert or activity, making them particularly useful for detecting complex attacks that involve multiple stages.

upvoted 6 times

...

chepeerick

Most Recent 7 months, 1 week ago

Option Correct

upvoted 1 times

...

chepeerick

7 months, 3 weeks ago

Selected Answer: A

option A

upvoted 1 times

...

herta

1 year, 4 months ago

Selected Answer: A

i will go for A Microsoft Sentinel uses Fusion, a correlation engine based on scalable machine learning algorithms, to automatically detect multistage attacks https://learn.microsoft.com/en-us/azure/sentinel/fusion

upvoted 5 times

...